An occurrence of Event 4614 is logged for each notification package on the system.

Notification packages are DLLs that Windows calls into whenenever a user changes his/her password. The purpose of a notification package is to let you evaluate passwords against your own rules for acceptability. The notification package answers back whether or not the password is acceptable. Notification packages are also used to implement password synchronization systems.

A rogue notification package would be a devastating security breach because notification packages are supplied with the clear text of the password and are simpler to write and install than authentication packages and logon processes (see 4610, 4611, and 4622).